CVE-2025-66413 HIGH

CVE-2025-66413: Git for Windows leaks NTLM hash when cloning from an attacker-controlled server

Vendor Git-For-Windows

Product git

Weakness CWE-200 · Info exposure

Published March 10, 2026

Last update March 11, 2026

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Key dates

02Disclosure timeline

March 10, 2026 CVE published

March 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66413 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2021-28544 Apache Subversion SVN authz protected copyfrom paths regression CVE-2025-61688 Omni leaks information via the API CVE-2026-41278 Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs CVE-2023-38499 typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution CVE-2024-34003 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup